Security Hardening Reference
Infrastructure security is an important topic that organizations scrutinize to stay compliant with the latest regulatory and legal requirements. Understanding where and how sensitive information is stored is of paramount importance to implement robust security measures and safeguard against unauthorized access, data breaches, or malicious attacks in your organization.
The specific details shown in the diagram may vary depending on how the system is deployed.
This document provides a reference explaining where sensitive information in API7 Gateway is, how it is stored, and how it is protected. For the recommended configuration steps and features you can turn on to harden a production deployment, see the companion guide Security Hardening in the Enterprise Features section.
Deployment Models (AWS)
Below are the deployment models for hosting API7 Gateway in AWS.
Client-Managed Deployment
In the client-managed deployment model, both the control plane (CP) and data plane (DP) are deployed in your AWS environment.
Hybrid-Managed Deployment
In the hybrid-managed deployment model, the control plane (CP) is hosted in API7’s AWS environment, while the data plane (DP) is hosted in your AWS environment.
Data Storage
- Business data is stored in the database.
- Gateway metrics are stored in Prometheus.
- Gateway access logs and error logs are stored locally on each gateway instance by default, but they can also be forwarded to external logging services if needed.
Specifically, the database stores the following types of business data:
- Gateway configuration data: Entities that define gateway behavior, such as services, routes, consumers, SSL certificates, and other core resources.
- Management and operational data: Administrative and governance-related information, including control plane administrators, RBAC policies, SSO authentication configuration, and audit logs.
Control Plane (CP)
Database Connection Credentials
Database connection credentials are stored in the control plane's configuration files. They can also be stored in environment variables and injected into the configuration files.
Plugin Resources
Sensitive plugin fields are identified by encrypt_fields in the plugin schema. The control plane encrypts these fields before saving them to the database. An authorized Admin API reader can still receive decrypted credential values. Do not rely on this encryption to protect credentials if the database or a backup is compromised.
Each gateway group has its own keyring. The Control Plane stores the keyring using the same application-level field encryption described above, so it is not protected from database or backup compromise.
SSL Resources
For SSL resources, the private key is encrypted at rest. Subsequent reads return metadata and the public certificate, but not the private key. A create or update response can echo the private key just submitted, so protect those responses as well.
Dashboard Connections
Dashboard connections use TLS by default. If no certificates are configured, API7 uses self-signed certificates.
Audit
API7 masks known sensitive fields in supported request and response structures. When request or response JSON is captured outside those structures, it is stored without masking. Treat audit logs as sensitive data and protect the Control Plane database against direct modification or deletion.
User Credentials
Built-in user passwords and access tokens are salted and stored as PBKDF2-derived hashes. Usernames are stored for account lookup.
Encryption Algorithms
In cases where the field should not be reversible, the hashing algorithm would be PBKDF2 with salt.
In cases where the field should be reversible, the encryption algorithm would be AES.
Data Plane (DP)
Between clients and API7 Gateway, as well as API7 Gateway and upstream services, you can configure TLS or mTLS to secure the communication.
Communication Between DP and CP
Dashboard-generated deployments connect to the DP Manager on port 7943 with mTLS. On this path, long polling, heartbeat, and Prometheus metrics traffic is encrypted; the Control Plane stores the server and CA certificates, and each Data Plane instance stores a client certificate. The DP Manager also accepts HTTP connections on port 7900 with instance-token authentication. Traffic on port 7900 is not encrypted, so restrict it to trusted networks.